sneakoscope 10.3.4 → 10.3.5

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.4**. Install the latest stable release from npm.
+Current package: **SKS 10.3.5**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -104,6 +104,7 @@ home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script,
 | Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
 | Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
 | MCP Servers | Manage server configuration, health checks, and authentication. |
+| Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
 | Diagnostics | Inspect issues and run targeted checks. |
 | Settings | Configure lifecycle behavior, notifications, and advanced options. |
 | Remote Coding | Find the independent [Paseo companion](https://paseo.sh/docs) and its setup guidance. |
@@ -136,6 +137,204 @@ Enter credentials through the native connection dialog or the CLI's
 `--api-key-stdin` option. See the [provider guide](docs/codex-lb.md) for
 configuration, transport checks, and recovery commands.
 
+## Image generation
+
+SKS image routes (image generation, UX-Review callouts, PPT assets, slide
+reviews) follow one image mode. By default they use Codex's own image
+generation. Turn on a custom image model on the **Image Generation** page to
+send every SKS image through the Desktop Bridge to an OpenRouter image model
+you pick. SKS pins no image model and records which model made each image.
+
+```sh
+sks imagegen status --json
+sks imagegen models --json
+sks imagegen enable --model black-forest-labs/flux.2-klein-4b
+sks imagegen generate --prompt "App icon, flat, blue" --out icon.png
+sks imagegen disable
+```
+
+See [Image generation](docs/image-generation.md) for both modes, evidence
+sidecars, and the Jev choices.
+
+## Naruto workflow
+
+The parent orchestrates: it decomposes the task, spawns a child for each
+disjoint slice, waits, and owns integration and final verification. It does not
+implement slices itself. The SKS PreToolUse hook denies parent source edits
+until the first child starts and while children are still running. Children
+receive bounded tasks and do not spawn children.
+
+No model family is pinned. Every child runs the newest model of the tier its
+work needs, read from the Codex models cache, so a new model family is used as
+soon as Codex lists it:
+
+| Work | Tier | Effort | Today |
+| --- | --- | --- | --- |
+| Tiny mechanical tasks | fast | low | `gpt-6-luna` |
+| Instructed implementation | balanced | low | `gpt-6-sol` |
+| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6-sol` |
+| Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
+
+With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
+the plan, and the context, so the parent spends no time on those choices. It
+also picks the pipeline for each prompt; an explicit SKS `<div align="center">
+
+<img src="docs/assets/sks-logo.svg" alt="Sneakoscope Codex logo" width="120" height="120" />
+
+# Sneakoscope Codex
+
+**Plan, build, and verify with Codex.**
+
+[![npm version](https://img.shields.io/npm/v/sneakoscope?color=cb3837&logo=npm)](https://www.npmjs.com/package/sneakoscope)
+[![node](https://img.shields.io/badge/node-%3E%3D20.11-339933?logo=node.js&logoColor=white)](#requirements)
+[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+</div>
+
+<!-- BEGIN SKS SEARCH VISIBILITY MARKETING -->
+Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
+<!-- END SKS SEARCH VISIBILITY MARKETING -->
+
+Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+
+[Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
+
+## Install in one command
+
+```sh
+npm exec --yes --package=sneakoscope@latest -- sneakoscope install --yes
+```
+
+The installer resolves the latest release, installs it globally, runs setup and
+Doctor, and checks that `sks` on your PATH points to the installed version.
+
+To set up a project, run this from its root, then open it in Codex:
+
+```sh
+sks bootstrap --yes
+```
+
+## What SKS adds
+
+| Capability | What you get |
+| --- | --- |
+| Focused execution | Answers and tiny edits stay lightweight; implementation work runs through official Codex subagents while the parent orchestrates and integrates. |
+| Project context | TriWiki indexes repository code and supplies bounded context that can be checked against source. |
+| Verification | Tests, diagnostics, and release evidence support completion claims. Security and data-integrity checks stay in place. |
+| Native controls | SKS Center brings connections, updates, MCP servers, and diagnostics together on macOS. |
+| Consistent setup | `sks update` installs the latest release, runs Doctor, and reconciles SKS-managed files and legacy assets. |
+
+The default `essential` profile avoids repetitive completion rituals. `strict`
+adds stronger completion requirements. See [Essential Trust](docs/essential-trust.md).
+
+With Codex-LB connected, `sks agent-bridge async --prompt "Check SKS status while
+explaining what the check covers" --tools status --json` runs native Astra Async
+tool calling with selected read-only SKS tools, using WebSocket first and safe
+HTTP fallback. See [Astra guidance](docs/astra-guidance.md)
+for setup boundaries and reported execution evidence.
+
+## Everyday commands
+
+SKS enables experimental Astra context management by default during setup and
+repair. Turn it off in **SKS Center → Settings → Astra context management**, or
+use `sks codex-app context-management off`. Updates preserve an explicit opt-out.
+Start a new task after changing the setting. Availability depends on a supported
+Codex client and eligible ChatGPT sign-in; API-key and custom-provider sessions
+may not activate it. See [OpenAI's context management guidance](https://learn.chatgpt.com/docs/models#experimental-context-management).
+
+Use these inside a Codex conversation:
+
+| Command | Purpose |
+| --- | --- |
+| `$sks-plan "task"` | Create a plan without editing product code. |
+| `$sks-work` | Execute the latest plan. |
+| `$sks-naruto "task"` | Run an official subagent workflow. |
+| `$sks-review` | Review the current changes. |
+| `$sks-help` | Explore available SKS workflows. |
+
+Use these in your terminal:
+
+```sh
+sks --help
+sks status --json
+sks review --staged
+sks doctor --json
+sks update-check
+sks update
+```
+
+`sks update` runs setup reconciliation even when the package is already current.
+It preserves user-authored configuration and cleans up recognized SKS-owned
+legacy assets. If a check needs attention, follow its reported recovery action
+in your terminal.
+
+## SKS Center (macOS)
+
+Open **SKS Control Center** from the SKS menu bar.
+The Menu Bar app (with the Control Center) is built from source on macOS when you run
+`npm i -g sneakoscope` interactively in a terminal, and by `sks install`, `sks doctor --fix`,
+`sks update`, or `sks menubar install`. Dependency, CI, and piped installs never touch your
+home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script, or
+`SKS_POSTINSTALL_NO_MENUBAR=1` to skip it.
+
+| Page | Use it to |
+| --- | --- |
+| Overview | Check local health and find the next action. |
+| Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
+| Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
+| MCP Servers | Manage server configuration, health checks, and authentication. |
+| Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
+| Diagnostics | Inspect issues and run targeted checks. |
+| Settings | Configure lifecycle behavior, notifications, and advanced options. |
+| Remote Coding | Find the independent [Paseo companion](https://paseo.sh/docs) and its setup guidance. |
+
+Connection controls appear first. Model catalogs, bridge diagnostics, and
+advanced settings expand when you need them.
+
+## Desktop Bridge
+
+One local bridge manages routing for independent **Codex-LB** and **OpenRouter**
+profiles. ChatGPT sign-in remains owned by Codex. Provider choices and existing
+session pins remain authoritative; unavailable routes are reported explicitly.
+
+In **Connections**, turn on **Prefer Codex-LB** to use the saved Codex-LB
+connection first for eligible models. The switch distinguishes a saved preference
+from connection readiness: **on but unavailable** means setup needs attention.
+Turning it off restores the configured official-model routing preference.
+
+The same controls are available from the CLI:
+
+```sh
+sks bridge auth-priority status --json
+sks bridge auth-priority on --json
+sks bridge auth-priority off --json
+sks bridge status --json
+sks bridge route explain gpt-6-astra --json
+```
+
+Enter credentials through the native connection dialog or the CLI's
+`--api-key-stdin` option. See the [provider guide](docs/codex-lb.md) for
+configuration, transport checks, and recovery commands.
+
+## Image generation
+
+SKS image routes (image generation, UX-Review callouts, PPT assets, slide
+reviews) follow one image mode. By default they use Codex's own image
+generation. Turn on a custom image model on the **Image Generation** page to
+send every SKS image through the Desktop Bridge to an OpenRouter image model
+you pick. SKS pins no image model and records which model made each image.
+
+```sh
+sks imagegen status --json
+sks imagegen models --json
+sks imagegen enable --model black-forest-labs/flux.2-klein-4b
+sks imagegen generate --prompt "App icon, flat, blue" --out icon.png
+sks imagegen disable
+```
+
+See [Image generation](docs/image-generation.md) for both modes, evidence
+sidecars, and the Jev choices.
+
 ## Naruto workflow
 
 The parent orchestrates: it decomposes the task, spawns a child for each
@@ -156,8 +355,9 @@ soon as Codex lists it:
 | Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
 
 With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
-the plan, and the context, so the parent spends no time on those choices. A
-stored role-model preference on a current model wins in both modes.
+the plan, and the context, so the parent spends no time on those choices. It
+ command always
+wins. A stored role-model preference on a current model wins in both modes.
 
 An active Codex task keeps the user's selected main model, effort, and service
 tier. Codex native `/goal` remains the persisted goal owner. Parallelism depends

package/config/skills-hash-ledger.v1.json

@@ -14,6 +14,7 @@
     {
       "canonical_name": "sks-align",
       "trusted_sha256": [
+        "9eef36214be7e07a963eb36bb1df2c025cd0578b7419ddf4fd307081a2b62093",
         "b9db40d6e1dd2fc6e4665a2b30738d370da955cd4d6e86c88bd85059c7faa08c",
         "c485f39d4873adb9793672f7dcf4e956595ffb9dcbb032b3ffb0515b5857d31d",
         "e98e1b67e228bec5c37d00c0206a2e01d2da698a83c80b527105bf04a19c136a"
@@ -56,6 +57,7 @@
     {
       "canonical_name": "sks-commit",
       "trusted_sha256": [
+        "63cad87de9187f67e001949b0edcf39344626748f8f168bed257316dc1684d53",
         "aa2eeaa6be6d635170a8ecfc76353db95552f543cca107f239054c492409e3a9",
         "aea41328993b11e26e26ae94df6ed44312d1570ed39448531428b53ade9d7461",
         "943c6dcf822df086b320140e74404d4c7bcfd531264e25ada6624b5009f26207"
@@ -64,6 +66,7 @@
     {
       "canonical_name": "sks-commit-and-push",
       "trusted_sha256": [
+        "2307093e26513a26e71ac6cdfcf3fd1598979c6035525ee5d3de58820cb4adda",
         "acd6c7845c58d72234776e4608e1440583c62c38b513625d1272e4a413a40fb6",
         "8e4ff7a39440c82e6c67a67d5bb267c69f508cedb5d9d5a93261f4dcdf8e8a1a",
         "b005b4a7456b80b95768ad358fe5950bf517483c6de71aec14ee3d1c600cc074"
@@ -126,6 +129,7 @@
     {
       "canonical_name": "sks-design-artifact-expert",
       "trusted_sha256": [
+        "6881c1acff42b3cc760f089165a6ea753c774882bf0ec989b71f14936e894690",
         "6db9a7088e5f8d21dec9c8eed00abe665e1e89f19dcbb6d8472d77e4551cb556",
         "a09daba0a2e479a68ed81ec6fba8d70e54c8398ed86f3d1879f874b98480b97c",
         "4a28d166eaf0bc4477b566b056034f972a7034165e36d8186daa9947bf92e3cf"
@@ -134,6 +138,7 @@
     {
       "canonical_name": "sks-design-system-builder",
       "trusted_sha256": [
+        "9075bc17039da34ddd7d798009fdbcdedb8d03358a29c9a925d194bd76e9dcc4",
         "47654c9f74317abbd0a5a75f89cd2d563708e8234e8887cc7ab39bf49030abaa",
         "0a41e6ace960abaaf6abf5e7b1e53fd39f414e1e00b59fa725f2db9e3eb05b58",
         "c4f0007cad5774510bdc55e2815ce0911c220afa8d5dd4efc327ba1231c8f3da"
@@ -142,6 +147,7 @@
     {
       "canonical_name": "sks-design-ui-editor",
       "trusted_sha256": [
+        "c3bc8bbaac134f7d742cd5e4bed7dd61a99655c54a6bd42f669e6bdd033156fb",
         "2f9087664d8abe938a6dfbeaef5301ef00531e34a15506508e1d6d6b7132b894",
         "6c24e950a12dec52c625964069c7c21a0220a58e0f69f977d802f44fdb03a940",
         "83a806cc93a3c5342e0dccfc6a45983382d5bf74d1226c4e3288228db22b737a",
@@ -201,6 +207,7 @@
     {
       "canonical_name": "sks-goal",
       "trusted_sha256": [
+        "942c5e8db400cc1cd2b5ca9527124135fb4b8d9e8289338632d8929691aa54ed",
         "36c12285a339f9505fd88d6d9ea5691e451449f0bf8f55c21f51f0d715623235",
         "5ab1ac18fc265c375bae92ff23ddbd80c378484d6629c378f0e9270e660ded11",
         "867544877ac04df6e0232d6d425797e7fab2cceff9a7176a3c9e61f8c4a416d7",
@@ -277,6 +284,7 @@
     {
       "canonical_name": "sks-image-ux-review",
       "trusted_sha256": [
+        "643400c1682aaa4a84782e3740eb14efb0ddb905a84c086bd9a0f8afdabd5f02",
         "c7a5ea91adb0d45e652066cdb73f514cc7fcb47121cc13cce5e177f94630a42a",
         "54d4169dc7f362ac9fe2d090bd2612e41d30acbc3e883d6bd382929bdfb9459e",
         "9293346873b5fb25a9d93b630064a2c8ceede2bfdfa4c6ffe7fbb7f64da6595c"
@@ -285,6 +293,7 @@
     {
       "canonical_name": "sks-imagegen",
       "trusted_sha256": [
+        "0f3ba271f2977d1124b8236e25f5e05a3d03af234652e39601dc5054346e306c",
         "ebad63dae59ff70a4404148d09bffaca69e6c43e88d6e9f6f3d0dc4d5a4c65f6",
         "478e3d8f805eed55c3f3e6c2069142482a7dbd8fa5d9a59f03b136e0e1cb77d0",
         "a7f466ba1829a757f38432fbe8c3a672e22e91948537dafe8f8ce09561d2256e",
@@ -294,6 +303,7 @@
     {
       "canonical_name": "sks-imagegen-source-scout",
       "trusted_sha256": [
+        "84957463d326f0f7028fc47aabb3f1857c76f13534e3aed1c9fc1b075896dbd1",
         "b306134faf487b86e11a9736ea1ed60d2335eef858e58bedc80fd3dc4ff7137c",
         "440f361fb29afcbb6f6cdc88c6a7318953b4c8fd3181ef7c6d8187f091d18745",
         "95faf4358f1c6567ca6894bfb577629f14a23d623716be70325c0ff9a893d42e",
@@ -325,6 +335,7 @@
     {
       "canonical_name": "sks-naruto",
       "trusted_sha256": [
+        "c88999663811a50d096b7cbb696fbea5b8f72707bcbf4a232bb07fe3a10cb2a6",
         "b2eb207b2773ab1995ee6e113ba6f3b64de43389e76aef4a0f06d4845ff86223",
         "65e19a5d16f486b13541048c239e828f8039bfc6e38bafd7949d9c936fe4b5b2",
         "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
@@ -332,7 +343,6 @@
         "5df9c9678eb68fd79ceb998ae7a52dd54dc92336ad5169e8a01acca89f76bd60",
         "a1219f6dbad9c8c185953125ef0b8dccf081aa01efb8e8acaa543c6214ac049c",
         "d0d5968e78ac25e1d3e588735de1ddbcf149cfb3165edebca5dec1ed7c7a5c46",
-        "34222c72e4e1ead3584907f4d905444b7de820283ee7348018f110d5e6b04461",
         "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"
       ]
     },
@@ -347,6 +357,7 @@
     {
       "canonical_name": "sks-pipeline-runner",
       "trusted_sha256": [
+        "15159b6f6edea91be29612fe3cee2047d8ec47f4f7c95a33601198a9bfec3eda",
         "6f38d3387e4ab020291afe7f74713b135543e52707f5bfbffa6b3584542f45a5",
         "7749638f1e8393f3beb1f7b0c37195dd0463abdb6fd7da5d31b3d816ee91fa37",
         "fd06dfb27be41e5ffec3e3ec8c5362289f5919cf2afa9da5ab6b97e7baa4a0ac",
@@ -358,6 +369,7 @@
     {
       "canonical_name": "sks-plan",
       "trusted_sha256": [
+        "81b49b026cd6761a1b63029d8d39b830e0801a7f3d2f9a8609127769173ddd4e",
         "7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a",
         "b6f3b09230e9809acf4e13df2de6af3c75a8534e8890d6560664ebfc2e4072f8"
       ]
@@ -365,6 +377,7 @@
     {
       "canonical_name": "sks-ppt",
       "trusted_sha256": [
+        "a25e537ff49b5bffdc093a5f772a8d218003ca1bb81e0aa304561684a9551b31",
         "fba3f438b9f22dae0813cd12bf310539a7d2b71c8cd9322eb840514e24884eaf",
         "c9a0d90e12560dd3f04959869051370e6baf46eda6eb63f708ea1661c5c9d041",
         "1d4de05afd42ee5739c0ed925af9e0ac4785fc746e659c60d3d908d465e6386c",
@@ -375,6 +388,7 @@
     {
       "canonical_name": "sks-prompt-pipeline",
       "trusted_sha256": [
+        "5e423981384fc3825c74327c4ca0fe09905a0dc81a533676c7e76ebb385348fc",
         "f82a103e7962e416961add515d7b3e65df89848dec1fbb9319bd49d7f1dac982",
         "93fd938dccd65d9b4d1dd140b60e1baedc627e7fcc54f9afd95eb2e44efd1143",
         "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
@@ -393,6 +407,7 @@
     {
       "canonical_name": "sks-reasoning-router",
       "trusted_sha256": [
+        "b0f458caa1c3bd7bb7241a09b80fce5700aeb99b340e84c08a9b2b66bc875ba7",
         "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
         "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
@@ -422,6 +437,7 @@
     {
       "canonical_name": "sks-research",
       "trusted_sha256": [
+        "b7280ca8a5ccf4304d25e97522d57968d20af6ec9f03f7d55a251ebcf8666236",
         "d61163446ebc429974aad8467653ddb5948739978600e9c27bff385fc53968ba",
         "8903022e98fa470cd764f7c8d1b28d4f996d6daf146260f20548acbe1276c55a",
         "2e96f95315d99b645d4171ba4648d9f9218ec3e98dcd6d363b5de522d2e1bfe3"

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.4"
+version = "10.3.5"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.4"
+version = "10.3.5"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -96,7 +96,8 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'bench', summary: 'Run core trust-kernel benchmark budgets', maturity: 'beta' },
     { name: 'mcp-server', summary: 'Run a stdio MCP server exposing SKS commands as tools for MCP-capable agent hosts', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true },
     { name: 'agent-bridge', summary: 'Register SKS tools or run read-only tools with native Astra async calling', maturity: 'beta', readonly: true, diagnostic: true },
-    { name: 'decision', summary: 'Manage optional Jev decisions through OpenRouter: status, enable, disable, probe, evaluate', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true }
+    { name: 'decision', summary: 'Manage optional Jev decisions through OpenRouter: status, enable, disable, probe, evaluate', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true },
+    { name: 'imagegen', summary: 'Generate images with the active SKS image mode (Codex default or a custom OpenRouter model): status, models, enable, disable, generate', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true }
 ];
 const SAFE_COMMAND_CONTRACT_LITE = {
     risk: 'R2',
@@ -109,6 +110,7 @@ const SAFE_COMMAND_CONTRACT_LITE = {
 const COMMAND_CONTRACT_OVERRIDES_LITE = {
     align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     decision: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
+    imagegen: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     cleanup: { risk: 'R3', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },

package/dist/cli/command-registry.js

@@ -254,11 +254,19 @@ const COMMAND_DEFINITIONS = {
             activeRoutePolicy: 'always'
         })),
         packageRequiredFiles: ['dist/commands/decision.js']
+    },
+    imagegen: {
+        ...skipMigrationGate(entry('beta', 'Generate images with the active SKS image mode (Codex default or a custom OpenRouter model): status, models, enable, disable, generate', 'dist/commands/imagegen.js', directCommand(() => import('../commands/imagegen.js'), 'dist/commands/imagegen.js'), {
+            allowedDuringActiveRoute: true,
+            activeRoutePolicy: 'always'
+        })),
+        packageRequiredFiles: ['dist/commands/imagegen.js']
     }
 };
 const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(COMMAND_DEFINITIONS, {
     align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     decision: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
+    imagegen: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     cleanup: { risk: 'R3', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },

package/dist/cli/install-helpers.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../core/imagegen/imagegen-model-policy.js';
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import { stdin as input, stdout as output } from 'node:process';
@@ -70,7 +69,7 @@ export async function postinstall({ bootstrap }) {
         console.log('Configure providers explicitly with `sks bridge provider configure codex-lb ...` or `sks bridge provider configure openrouter ...`.');
         const imagegenRepair = await ensureCodexImagegenDuringInstall();
         if (imagegenRepair.status === 'ready')
-            console.log(("Image generation provider capability ready (requested model: " + IMAGEGEN_MODEL + "; output not verified)."));
+            console.log('Image generation ready for the active SKS image mode (output not verified).');
         else if (imagegenRepair.status === 'recovered')
             console.log('Codex App Image Gen: recovered and re-detected. Start a new Codex/Work task; restart the desktop app only if the new task still lacks $imagegen.');
         else if (imagegenRepair.status === 'blocked')

package/dist/commands/doctor.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../core/imagegen/imagegen-model-policy.js';
 import os from 'node:os';
 import path from 'node:path';
 import { projectRoot, exists, formatBytes, nowIso, readText, writeJsonAtomic } from '../core/fsx.js';
@@ -1189,7 +1188,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 blockers: ['codex_imagegen_current_task_tool_manifest_unverified', 'codex_imagegen_real_output_unverified'],
                 manual_actions: [
                     'Start a fresh Codex/Work task so $imagegen is present in its tool manifest.',
-                    ("Invoke $imagegen with " + IMAGEGEN_MODEL + " and bind the selected raster output path to route evidence.")
+                    'Run `sks imagegen generate` (it follows the active SKS image mode) and bind the raster output path to route evidence.'
                 ],
                 communication_test: {
                     level: 'flag_level',

package/dist/commands/imagegen.js

@@ -0,0 +1,154 @@
+import path from 'node:path';
+import { flag, readOption } from '../cli/args.js';
+import { printJson } from '../cli/output.js';
+import { readDecisionConfig, jevEnabled } from '../core/decisions/config.js';
+import { imagegenConfigPath, imagegenSelection, readImagegenConfig, writeImagegenConfig, isOpenRouterModelId } from '../core/imagegen/imagegen-config.js';
+import { generateSksImage } from '../core/imagegen/imagegen-generate.js';
+import { listOpenRouterImageModels } from '../core/imagegen/openrouter-images.js';
+import { decideImagegenParameters } from '../core/imagegen/imagegen-jev.js';
+import { resolveOpenRouterApiKey } from '../core/providers/openrouter/openrouter-secret-store.js';
+export const IMAGEGEN_STATUS_SCHEMA = 'sks.imagegen-status.v1';
+const USAGE = [
+    'Usage: sks imagegen status|models|enable|disable|generate [options] [--json]',
+    '  status                         Show the active image mode (Codex default or custom OpenRouter model).',
+    '  models [--refresh]             List OpenRouter models that output images.',
+    '  enable --model <id>            Use this OpenRouter image model through the SKS Desktop Bridge.',
+    '  disable                        Go back to Codex default image generation.',
+    '  generate --prompt <text> --out <file> [--reference <file>]... [--aspect <ratio>] [--quality <q>]',
+    '                                 Make an image with the active mode and write evidence next to it.'
+].join('\n');
+async function statusPayload(config, env, extra = {}) {
+    const selection = imagegenSelection(config);
+    const key = await resolveOpenRouterApiKey({ env }).catch(() => ({ key: null }));
+    const jev = await readDecisionConfig(env).then(jevEnabled).catch(() => false);
+    const warnings = [];
+    if (config.mode === 'openrouter' && !key.key)
+        warnings.push('openrouter_key_missing');
+    return {
+        schema: IMAGEGEN_STATUS_SCHEMA,
+        ok: true,
+        mode: config.mode,
+        custom_model_enabled: config.mode === 'openrouter',
+        openrouter_model: config.openrouter_model,
+        openrouter_key_present: Boolean(key.key),
+        effective: { provider: selection.mode, model: selection.model, label: selection.label },
+        jev_enabled: jev,
+        blockers: [],
+        warnings,
+        config_path: imagegenConfigPath(env),
+        ...extra
+    };
+}
+function print(payload, json) {
+    if (json) {
+        printJson(payload);
+        return;
+    }
+    if (payload.schema === IMAGEGEN_STATUS_SCHEMA) {
+        console.log(`Image generation: ${payload.effective?.label}`);
+        if (payload.custom_model_enabled && !payload.openrouter_key_present)
+            console.log('Warning: no OpenRouter key; add it in SKS Control Center (Connections, OpenRouter) or with `sks bridge provider configure openrouter --api-key-stdin`.');
+        for (const warning of payload.warnings || [])
+            if (warning !== 'openrouter_key_missing')
+                console.log(`Warning: ${warning}`);
+        for (const blocker of payload.blockers || [])
+            console.log(`Blocked: ${blocker}`);
+        return;
+    }
+    console.log(JSON.stringify(payload, null, 2));
+}
+function readAll(args, name) {
+    const out = [];
+    for (let i = 0; i < args.length; i++)
+        if (args[i] === name && args[i + 1])
+            out.push(args[i + 1]);
+    return out;
+}
+export async function run(_command, args = []) {
+    const env = process.env;
+    const json = flag(args, '--json');
+    const action = args.find((arg) => !arg.startsWith('-')) || 'status';
+    if (flag(args, '--help') || flag(args, '-h')) {
+        if (json)
+            printJson({ ok: true, command: 'imagegen', usage: USAGE, mutated: false });
+        else
+            console.log(USAGE);
+        return;
+    }
+    if (action === 'status') {
+        print(await statusPayload(await readImagegenConfig(env), env), json);
+        return;
+    }
+    if (action === 'models') {
+        const list = await listOpenRouterImageModels({ env, refresh: flag(args, '--refresh') });
+        const config = await readImagegenConfig(env);
+        const payload = { ...list, models: list.models.map((model) => ({ ...model, selected: model.id === config.openrouter_model })) };
+        if (json)
+            printJson(payload);
+        else
+            for (const model of payload.models)
+                console.log(`${model.selected ? '*' : ' '} ${model.id}  ${model.name}`);
+        if (!list.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (action === 'enable') {
+        const model = String(readOption(args, '--model', '') || '').trim();
+        const before = await readImagegenConfig(env);
+        const fail = async (blocker) => {
+            print({ ...(await statusPayload(before, env)), ok: false, blockers: [blocker], changed: false }, json);
+            process.exitCode = 1;
+        };
+        if (!model)
+            return fail('imagegen_model_required');
+        if (!isOpenRouterModelId(model))
+            return fail('imagegen_model_not_image_capable');
+        const list = await listOpenRouterImageModels({ env });
+        if (!list.ok)
+            return fail(list.blockers[0] || 'openrouter_models_unavailable');
+        const row = list.models.find((candidate) => candidate.id === model);
+        if (!row)
+            return fail('imagegen_model_not_image_capable');
+        const next = await writeImagegenConfig({ mode: 'openrouter', openrouterModel: model }, env);
+        const payload = await statusPayload(next, env, { changed: before.mode !== next.mode || before.openrouter_model !== next.openrouter_model });
+        if (row.max_references === 0)
+            payload.warnings.push('imagegen_model_takes_no_reference_images');
+        print(payload, json);
+        return;
+    }
+    if (action === 'disable') {
+        const before = await readImagegenConfig(env);
+        const next = await writeImagegenConfig({ mode: 'codex' }, env);
+        print(await statusPayload(next, env, { changed: before.mode !== 'codex' }), json);
+        return;
+    }
+    if (action === 'generate') {
+        const prompt = String(readOption(args, '--prompt', '') || '').trim();
+        const out = String(readOption(args, '--out', '') || '').trim();
+        if (!prompt || !out) {
+            print({ schema: 'sks.imagegen-generate.v1', ok: false, blockers: [!prompt ? 'imagegen_prompt_required' : 'imagegen_out_required'], usage: USAGE }, json);
+            process.exitCode = 1;
+            return;
+        }
+        const references = readAll(args, '--reference').map((file) => path.resolve(file));
+        const explicitAspect = readOption(args, '--aspect', null);
+        const explicitQuality = readOption(args, '--quality', null);
+        const jev = explicitAspect && explicitQuality
+            ? null
+            : await decideImagegenParameters({ root: process.cwd(), prompt, hasReference: references.length > 0, ask: { aspect: !explicitAspect, quality: !explicitQuality }, env }).catch(() => null);
+        const result = await generateSksImage({
+            prompt,
+            outPath: path.resolve(out),
+            references,
+            aspectRatio: explicitAspect || jev?.aspectRatio || null,
+            quality: explicitQuality || jev?.quality || null,
+            env
+        });
+        print({ ...result, jev }, json);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    print({ ok: false, blockers: [`imagegen_unknown_action:${action}`], usage: USAGE }, json);
+    process.exitCode = 1;
+}